SolarWinds Orion Network Performance Monitor

Transcription

1 SolarWinds Orion Network Performance Monitor Joe Dissmeyer Chapter No. 3 "Device Management"

2 In this package, you will find: A Biography of the author of the book A preview chapter from the book, Chapter NO.3 "Device Management" A synopsis of the book s content Information on where to buy this book About the Author Joe Dissmeyer has a strong background in enterprise-class software and IT systems which include VMware, Windows Server, Windows Desktop, Exchange Server, and Cisco. He holds multiple IT certifications and has an A.S. degree in Computer Information Science. Joe currently works as part of a team of network engineers for a company in central Florida. Prior to accepting this position, he was working as a Senior Technician for a healthcare provider, a Domain Administrator for a small college, and a Service Desk Specialist for a Fortune 100 company. Joe is well versed in server, desktop, and network administration.

3 Aside from his full-time job, Joe is a managed service provider for a few small businesses in central Florida where he provides various remote and onsite IT consulting services. He volunteers his knowledge and skills by participating in the Microsoft Answers forums, the Spiceworks IT Professional Community, and frequently posts troubleshooting and tech articles on his website at Joe is an active member of his local community and shares the visual and audio setup responsibilities with his church's tech ministry team every week. Joe's specialties are the Windows desktop, Windows Server engineering, operating system deployment, network troubleshooting, and network administration. His biggest strength is that he has a deep understanding of how information technology systems work and how they affect a business. You can contact Joe through his website at or via at [email protected].

4 SolarWinds Orion Network Performance Monitor Have you ever had complaints from your customers about poor network performance? What about trying to find out what your bandwidth utilization is from the edge? If you are an IT administrator, I guarantee that you have had these types of tasks before. I recall a time when I was an IT administrator of a medium-sized business, working at the company headquarters. The business had a data center hosted in Little Rock, Arkansas with more than twenty different branch offices scattered throughout the United States. The data center was the central hub for all network connectivity for the entire organization with each branch office connected to the data center via private MPLS circuits. One day, my team received a call notifying us that one of the remote locations was without Internet access. There was literally no way for me to know why this happened without spending a great deal of time researching the issue. After an hour, we finally found the cause of the problem. The core router died during a lightning storm at that branch office. We were able to call a local technician to connect a spare router at the branch office and get our customers back online but the damage had been done. The total amount of downtime for our customers was four hours which was completely unacceptable for a company that relies on the Internet to perform its work. In a completely different example, I was working as a network administrator team member at another company where most of our users use a web-based application to perform their jobs. One day, I received an alert notifying me that our primary Internet link was down. I contacted our ISP who dispatched a technician immediately. As I was working on crafting a notification message to the company about the situation, I received a call that many of our customers' Internet connections were very slow, their web application was timing out, and they were unable to work. I informed the customer that we were working on the issue and notified the company of the problem. After a short period of time, the ISP technician arrived and resolved the problem. The total customer downtime for this scenario was 30 minutes. As you no doubt have observed, there are multiple issues with the first scenario. There was no alerting in the event of any type of network failure which limited the IT department to be proactive in such an event. The second scenario shows some of the best and most used features of a network monitoring system. Thanks to the core monitoring features of the monitoring system, I was able to determine the root cause of the problem quickly and have the ISP technician dispatched as soon as possible. Even though my customers experienced a network outage for 30 minutes, I'm sure you would agree that a downtime of 30 minutes is more acceptable than four hours.

5 SolarWinds Orion Network Performance Monitor is one of these types of monitoring systems and this book is going to discuss many of its features including what Orion NPM actually is, what it does, the technologies behind Orion NPM, and how Orion NPM can help to make your job as an administrator easier. What is Orion NPM? Orion Network Performance Monitor is a scalable, easy to use, cost-effective network monitoring system that provides a complete overview of network environments by monitoring performance and availability. Orion NPM enables you to be proactive in detecting, diagnosing, and resolving network issues and outages and has the benefit of supporting hundreds of types of server, OS, and network vendors including Cisco, HP, Microsoft, Linux, Motorola, Brocade, Foundry, and more. Orion NPM is used by thousands of public and private companies, educational institutions, and government entities and is a well-known product. Here is a list of important features that make Orion NPM stand out in the crowded network monitoring software market: Logical, useable, customizable, interactive, drill-down (LUCID) interface The SolarWinds Orion NPM LUCID interface is one of the key features of Orion NPM. It is a browser-based frontend for the entire SolarWinds Orion monitoring system dubbed the "dashboard". Every section of the dashboard is completely customizable. If you do not like viewing the top-level network map module on the Summary home page, it can be moved to a different menu bar or it can be removed entirely. Each module in every menu bar can be customized as well, or custom menu bars can be assigned to specific user accounts. The personalization and dashboard customization options are almost endless! Uses standard protocols to poll devices and servers In order to monitor servers and devices, many network monitoring solutions require an administrator to install and configure specialized client software on each server and network device. SolarWinds Orion uses industry-standard protocols that are already built into the software of each server and device, and does not require an administrator to install any additional software.

6 ConnectNow topology mapping One of the most time consuming tasks of a network administrator is the need to diagram the topology of a network. The most common tool used to map out a network is Microsoft Visio, but diagramming a network in Visio can take a great deal of time to perfect. Using the Network Sonar Wizard, Orion NPM uses proprietary "ConnectNow" technology to discover device relationships and automatically map those relationships for you in the Orion Network Atlas. Mobile views A simple view of the Orion NPM dashboard can be accessed from a mobile web device's web browser. No special "apps" need to be downloaded and installed from an app store in order to view the Orion Dashboard. Simply navigate to the dashboard URL on your mobile device's browser to view! Microsoft Active Directory integration User account authentication can be tied in with Microsoft Active Directory. Single accounts can be added to the account authentication in Orion NPM, or entire Active Directory security groups. This allows administrators to continue to centralize and secure authentication and accessibility on the network. Role-based access SolarWinds Orion NPM has a robust access control system that can be as granular as you need it to be. An administrator can grant a variety of permissions to specific areas of the Orion Dashboard, or even administrative portions of Orion NPM. Even more granularity is enabled when role-based access is combined with the integration of Microsoft Active Directory. Automated network discovery SolarWinds Orion NPM can be configured to automatically scan your network on a regular basis for devices and servers and add them to the Orion dashboard for monitoring. This helps to get Orion NPM set up quickly for new installations as well as making device management easier for administrators in existing installations. Multi-vendor device support, universal polling, and custom MIB creation Thanks to Orion NPM using industry-standard polling protocols, thousands of manufacturers and vendors are supported in Orion NPM. Orion NPM can also import customized MIBs from various vendors.

7 Conditional group dependencies Devices and/or servers can be grouped together with defined dependencies in a parent/child relationship. When the parent device is down, only a single alert notification will be sent instead of one for every child dependency. Wireless polling Orion NPM can monitor wireless access points and keep historical data of SSIDs, client IP addresses, IP addresses, signal strength, channel usage, and more. Virtual server monitoring You do not need to purchase additional licensing just to keep an eye on your VMware virtual server hosts. Orion NPM can do this out of the box! Both virtual server hosts and resident virtual machines for VMware ESX and ESXi are supported. Report Writer Orion NPM includes several preconfigured reports. Using the included Report Writer, you can write your own customized reports as well as automate their creation. VSAN summary SolarWinds Orion NPM can not only monitor your critical network devices and servers, but also your fiber channel and virtual storage. Orion NPM can alert administrators if VSAN storage volumes have low disk space, low I/O performance, and more. You can drill down to the nitty-gritty details on the fiber channel interfaces including transmitted and received data as well as utilization information. Community content exchange SolarWinds has created a comprehensive support community built around the Orion product line called Thwack. You can find expert advice forums, submit feature requests, download administrative scripts and Orion add-ons, free tools, and other content in the Thwack community.

8 Cisco EnergyWise monitoring Orion NPM can take advantage of Cisco's EnergyWise software component in Cisco Catalyst switches. EnergyWise is a part of Cisco's "Green Initiative" that monitors power consumption in Catalyst switches that can generate reports and alerts for power-related incidents. For example, if you have a port with Power Over Ethernet (PoE) capabilities and that port has PoE enabled, but the PoE is not in use on that port, Orion NPM can generate an alert for this port. EnergyWise is designed to help IT departments become "more green" and help with reducing power consumption, which will effectively help to lower costs. Do-it-yourself deployment You don't need to be an expert to install and set up SolarWinds Orion NPM on your network and you don't need to hire a specialized consultant to do it for you. Orion NPM is designed to be easy to install and set up. It is possible to set up a full Orion NPM solution within an hour! I should know, I've done it myself. As you can see, there are several core features of SolarWinds Orion NPM that helps differentiate it from the competition. As you become more familiar with Orion NPM using this book, you will discover even more features not listed above! How Orion NPM monitors your network The Orion NPM system is a database-driven web application which operates on top of Microsoft.NET server technologies. Microsoft Internet Information Services (IIS) is the web service for the Orion Dashboard and Microsoft SQL Server is the database backend for all information gathered from network devices and servers. Devices are added to the Orion NPM database either manually by IP address or DNS name, or automatically by using the Network Sonar Wizard. Once a device has been added to Orion NPM, it is polled for data by Orion NPM on a predefined timer, or counter. An internal process consistently runs in the background on the Orion NPM server that checks when to "kick off" the polling engine depending on the time set for a device in the counter. When that time has been reached, the device is polled. Orion NPM monitors a network using industry-standard protocols to poll data from network devices on a regular basis. The protocols used by Orion NPM to gather network information are Simple Network Management Protocol (SNMP), Windows Management Instrumentation (WMI), Internet Control Message Protocol (ICMP), and Syslog. Depending on the device, Orion NPM will use an appropriate protocol to gather information. For gathering data from a Cisco switch, Orion NPM would use SNMP or ICMP. To gather data from a Windows server, it may use WMI. The following diagram is a simple example of how Orion NPM monitors a network and how that information is presented:

9 It is important to understand not only how Orion NPM operates, but also understand the technologies, standards, and protocols that it uses. The next few sections describe several standard network monitoring protocols and how Orion NPM uses them. Simple Network Management Protocol (SNMP) SNMP is the most commonly used protocol for gathering monitoring data from computer systems and network devices and it consists of three components: managed devices, agents, and network management systems. A managed device could be a switch, router, server, or any other type of network device that has an SNMP agent. An SNMP agent is software on a device that translates data to SNMP-compatible language for transmission across a network to a network management system, such as SolarWinds Orion NPM. SNMP has been around almost since the beginning of the modern computer age and has gone through several revisions. SNMP is an IETF-standardized protocol and operates in one of two ways; the manager/agent model, and traps. In the manager/agent model, an SNMP agent is configured on a device to allow SNMP communication between itself and an SNMP manager. The SNMP manager periodically grabs the device's information from the SNMP agent. SNMP can gather an endless list of information from a network device such as memory usage, CPU utilization, power supply usage, syslog messages, humidity sensors, and so on. Most SNMP traffic is initiated by the SNMP manager, but SNMP traps can be configured on an SNMP agent to directly alert the management system of some type of abnormality, such as high CPU usage in a server or maxed-out bandwidth usage from an interface in a router. The information an SNMP trap transmits to alert an SNMP manager of a problem depends on what is defined in its Management Information Base (MIB). Some vendors offer a utility to create custom MIBs for SNMP agents for a particular device. Orion NPM can use all three iterations of the SNMP protocol; Version 1, Version 2c, and Version 3. Versions 1 and 2c are still considered the de-facto standards of SNMP by many and follow a simple community-based way of authentication using a defined IP port, community string, and/or a read/write community string. SNMPv3 builds on SNMPv2 and offers more robust security options. SNMP agents are typically disabled by default and must be configured manually by an administrator. The best thing about SNMP is that it is found in virtually every single

10 manageable network device and operating system on the planet so it makes sense that Orion NPM would utilize SNMP extensively. Windows Management Instrumentation (WMI) WMI is a management framework built into all modern Windows operating systems which grants administrative visibility to almost every aspect of the Windows OS. Management applications or administrative scripts can be created to view or manipulate components of Windows using WMI in a variety of programming languages. The most common type of administrative scripts that take advantage of WMI are VBScript and Windows PowerShell. Applications such as SolarWinds Orion NPM can make programmatic WMI calls to a Windows computer to access direct information about the operating system such as its IP address, MAC address, SNMP information, event logs, active and non-active services, and more. WMI can gather the same type of information from a computer that an SNMP agent can. Microsoft has a built-in security model for WMI, so before you go querying data from a Windows computer you need to make sure you have the proper access on that computer to do so. Internet Control Message Protocol (ICMP) Internet Control Message Protocol is more affectionately referred to as ICMP and it is one of the core protocols of the TCP/IP suite. ICMP allows network devices to send errors, control information, and informational messages to and from network device. PING may be the most commonly used command-line tool in most operating systems that best showcases the ICMP protocol. Syslog Syslog is another IETF-standardized protocol for event notification messages. It allows a network device to send event logs and event notifications to an event collection system, usually called a Syslog server or Syslog collector. Almost every network device and network server has its own internal logging system. Using syslog, it is possible to have a device automatically forward its event logs across the network to a Syslog server. Orion NPM has its own built-in Syslog server and stores retrieved syslog messages in its SQL Server database.

11 What This Book Covers This book strictly covers SolarWinds' flagship product, Orion Network Performance Monitor. Inside you will find all of the essential information required to install, set up, calibrate, and administer Orion NPM. Chapter 1, Installation, tells you how to install Orion NPM. Chapter 2, Orion NPM Configuration, builds upon the previous chapter and covers the initial configuration of Orion NPM. Chapter 3, Device Management, discusses how to add devices to Orion NPM, various polling methods, and how to managing devices. Chapter 4, Network Monitoring Essentials, gives an overview of the Orion website, discusses monitoring routers, switches, and wireless controllers. Chapter 5, Network Monitoring II, continues upon the previous chapter by discussing server and virtualization monitoring, including universal device pollers. Chapter 6, Setting Up and Creating Alerts, discusses the alerts and notification system in Orion NPM. Chapter 7, Producing Reports and Network Mapping, takes a look at the reporting system and network mapping utilities in Orion NPM. Chapter 8, Maintenance, discusses the various tools and tasks associated with maintaining an Orion NPM system. Appendix A, Documentation and Support, shows you the online resources you can refer to for more information and support. Appendix B, The Thwack Community, introduces you to the Thwack Community, a fully featured IT professional community for SolarWinds products. Appendix C, Additional SolarWinds Orion Software, talks about additional Solar Winds Orion products that can be used to extend Orion NPM's core functionality.

12 Device Management It is very rare that you will find two IT administrators very much alike. Most of us are like night and day; we are all very different in many ways. Every administrator has their own preferences on how they want to manage and monitor their network. Some prefer to maintain God-like control over their environment and micromanage every aspect of their network, especially when deciding who, what, when, and where to monitor their devices; while others prefer to utilize automation tools to help them easily stay on top of changes and additions to their network. Thankfully, SolarWinds has acknowledged this fact and provides several methods and processes for administrators to manage and monitor their network using Orion NPM. This chapter is all about how to manage your network nodes in Orion NPM. We will talk about how to add nodes to Orion NPM using both automated and manual processes, how to change monitoring configuration settings, how to edit Orion NPM's polling methods, and how to configure interface monitoring settings. We are also going to discuss different node management techniques, management methodologies, group and dependency management, and credentials management. Orion NPM provides administrators with two methods to add nodes, interfaces, and volumes to Orion NPM. One method is to use the Network Sonar Wizard. A second method is to add resources manually using the dashboard. Both methods eventually arrive at the same goal while providing administrators with several options on what they feel most comfortable with. By the end of the chapter you will have learned the following: Orion Discovery Central Device polling methods and polling configuration Node management techniques Group and dependency management Credentials management

13 Device Management Discovery Central Discovery Central is where you will find Network Sonar Discovery, which is the configuration utility for the Orion Discovery Engine (a core component of Orion NPM). Discovery Central is usually the first location that Orion administrators will go to create a discovery profile once they are ready to start monitoring devices in Orion NPM. A discovery profile is one that has been created using the Network Sonar Wizard to set up network scanning rules and schedules. You can create as many scanning profiles as needed that all have different rules and different schedules. For example, you could create a profile that scans for VMware hosts on a specific subnet automatically, and a second profile could be created for scanning only for switches and routers on a second subnet, but the scan must be run manually. The options are virtually endless. Network discovery A key feature of SolarWinds Orion NPM is the ability to automatically scan your networks for resources and present its findings in the dashboard. This makes it easier for administrators to be able to find devices on the network that need to be monitored, as well as making it faster to set up a new Orion NPM system. A network discovery scan does not automatically add nodes to Orion NPM for monitoring. Network discovery operates much like a high school study hall teacher; it takes attendance and writes the names down, that's it. After Orion knows what can be monitored, an administrator must still select what resources they want monitored with Orion NPM. So at this point you may be asking, "So why do I even want to bother with network scanning? I can just add all of the nodes manually myself!". Yes, that is true. You can add nodes manually and completely ignore the network discovery features of Orion NPM. But, consider you have several hundred nodes that you want to monitor with Orion NPM. If you just installed a fresh Orion NPM system, you would need to manually enter every one of your nodes one-by-one until all of them are monitored by Orion NPM. [ 78 ]

14 Chapter 3 Another consideration that I would keep in mind is for those that have a fairly dynamic network environment where change is commonplace. It is very easy to forget to log into a network monitoring system to remove old equipment and/or add new equipment. Personally, I have forgotten to add nodes to my SolarWinds Orion NPM system multiple times! Also, perhaps someone "fat-fingered" an IP address when trying to add a node to Orion NPM. The possibilities on why you would want to seriously consider using network discovery are endless. It is up to you if you want to actually use the network discovery tools in Orion NPM. You can always manually add nodes if you do not want to use, or cannot use, automated network discovery. Network Sonar Discovery is not a mandatory feature and is only available if you want to use it. If you are not interested in learning about network discovery, or only want to manually add nodes to Orion NPM, skip to the Manually adding nodes section in this chapter. Next up, we are going to talk about the Network Sonar Discovery page. It is the configuration web page for the SolarWinds Discovery Engine, one of the core programs of Orion NPM, and it is here where current discovery profiles are edited and new ones are created. To access the Network Sonar Discovery page, click on the Settings link on the upper-right corner of the dashboard to enter Orion Web Administration, and then click on the Network Sonar Discovery link under Getting Started with Orion. Using the Network Sonar Wizard The Network Sonar Wizard is a forms-based workflow wizard that makes it extremely easy to set up network scans. The wizard is used to create a network scanning profile. The workflow is always displayed on the top of the page so you can always see which step you are at in the wizard. You can always go back and make a change if you need to. [ 79 ]

15 Device Management Launching the Network Sonar Wizard is a fairly easy process. Simply click on the Discover My Network button to get started. The following items are configured while creating a new discovery profile in the Network Sonar Wizard: SNMP credentials VMware user credentials Windows user credentials Network subnets, IP ranges, or singular network hosts Discovery customization settings such as timeout and retry values Network scan frequency and scheduling SNMP credentials The first step in the wizard takes you through adding your various SNMP Version 2 and Version 3 credentials. Normally, you would only need to add one or two SNMP credentials to a single discovery profile. However, you may need to add more depending on the scope of your discovery scan. It is possible that within a single subnet there may be different devices with different SNMP community definitions or credentials. [ 80 ]

16 Chapter 3 You can create as many discovery profiles as you want, with as many SNMP credentials as you like. Orion will save and store these credentials in its database so you don't have to re-type them every time you want to add a node or create a new scanning profile. However, if you do not need to enter any SNMP credentials, you do not have to do so. Simply click on the Next button to continue. Once a node is detected during a network sonar discovery, Orion NPM will attempt to communicate with that node using all of the credentials defined in the profile. This means that if there are ten different SNMP credentials, Orion NPM will attempt all ten credentials in order. You can rearrange the credential priority as you see fit, and you can edit any of the credentials listed without leaving the wizard. A best practice for SNMP credentials in a scanning profile is to include only what is necessary. Adding a large number of credentials to a discovery profile can make a network discovery job take a very long time to complete. [ 81 ]

17 Device Management VMware user credentials After the SNMP page comes the step to define VMware credentials. If you intend for your discovery profile to scan and discover VMware hosts, be sure to enter a VMware login ID that has permission to poll the host. Otherwise, you can skip this step. For VMware credentials, the exact same concepts regarding SNMP credentials apply here as well. Orion NPM will store these credentials in its database. It is highly recommended to not use the root user ID for security reasons. Create a different local vcenter or ESX credential with read-only access to the VMware host. If your VMware hosts are able to process LDAP or Active Directory credentials, then it is recommended to use one of these credentials. If you do not need to poll for VMware hosts, then is it recommended to uncheck the box for Poll for VMware. Just as in SNMP credentials, you should only include the minimum VMware credentials in the scanning profile. Only include what is absolutely necessary. Windows user credentials Windows credentials are used to authenticate against Windows computers during a network scan. [ 82 ]

18 Chapter 3 The same concepts for VMware credentials and SNMP credentials apply here. (Are you starting to see a pattern emerge regarding credentials?). For Windows computers joined to a domain, it is recommended to create a domain service account, which will be used solely by SolarWinds Orion NPM to perform WMI queries. You may also use local Windows user accounts. Network The network step involves setting up the scanning profile to scan against one of three discovery methods: Subnets IP Ranges Specific Nodes Subnets One scanning method is by using subnets. When choosing to scan by subnet, you have two options. The first option is to define the actual subnet itself (that is /24). When defining subnets, Orion NPM will scan for devices against every IP address within that subnet. Depending on the security requirements in your organization, normally it is safe to perform full subnet scans on class C networks. An example of a class C subnet is /24. In my experience, discovering devices by scanning an entire subnet is the most common option only when scanning /24 subnets. This is a feasible option for those with smaller or more controlled networks, or if network nodes are spread across an entire subnet. To add a subnet, simply click on the Add a New Subnet button, type in your Subnet and Subnet Mask, and then click on Save. [ 83 ]

19 Device Management The second option is to define a seed router. This is a very powerful option since instead of scanning an entire subnet, you can have Orion NPM poll for IP addresses stored in a router's ARP table. This is very useful if you have very large subnets (such as a class B or class A network) and you do not want to manually define every separate subnet per scanning profile. You can add as many subnets and seed routers to the discovery profile as necessary. However, keep in mind that the more you add to the profile, the longer the network scan can take. IP Ranges Another scanning method is by using the IP range within a subnet, not the entire subnet itself. You would make this selection if you needed to scan against a specific range of IP addresses. Scanning by IP range helps to reduce the amount of time the discovery scan runs. Many network administrators reserve some IP addresses within a subnet for network devices with static IP addresses, such as switches and routers. If you look at the previous screenshot, I am only scanning to I am only scanning 54 IP addresses on this subnet because my DHCP server assigns dynamic DHCP addresses for workstations and printers in the to range. Another example on why you would choose to scan a specific IP address range is if you had a class A network. Performing a network scan on the entire class A subnet could literally take hours for the scan to finish, so it would be wise to only select a portion of IP addresses in the discovery profile. [ 84 ]

20 Chapter 3 Specific Nodes The last option available is Specific Nodes. Defining specific nodes allows an administrator to have complete control of what Orion NPM is allowed to scan. But this does mean that the administrator will have to manually change the discovery profile in the event of an IP address change on a device. If you have a strict list of IP addresses that you want to monitor, you know the specific IP addresses of specific nodes, or have strict security requirements to only scan what nodes are well known, this is the option you will choose. Copy/pasting from a text file works best when adding specific IP addresses. You must enter one IP address per line in the textbox on this page. If you are intending on monitoring nodes with IPv6 addresses, you must choose the Specific Nodes method when creating a discovery profile. Alternatively, if you have a router with both an IPv4 and IPv6 address, you can use the seed router method to discover nodes with IPv6 addresses. Orion NPM cannot scan IPv6 addresses by IP range or subnet at this time. [ 85 ]

21 Device Management Discovery Settings The Discovery Settings step is where you will define the discovery profile name, description, and communication timeout values. In the following screenshot, notice the option at the bottom of the page for Ignore nodes that only respond to ICMP (ping). Nodes must respond to SNMP, WMI. If you do not want to include devices that respond to pings in the discovery, make sure you place a check mark in the box. All of the settings on this page are self-explanatory. Most desktop operating systems, network printers, and other consumer network devices will respond to ICMP requests, so it is a good idea to enable the Ignore nodes that only respond to ICMP (ping). Nodes must respond to SNMP, WMI option for heavily-populated networks. Frequency and scheduling The last step in configuring a discovery profile is for scheduling. There are only two different options available in this step, they are to set the frequency and execution. [ 86 ]

22 Chapter 3 In selecting the scanning frequency, you must define a custom time frame, either to run only once, or run daily. Running a scan daily is the natural choice for most small, medium, or more controlled networks. However, a custom scan may be needed to run weekly for less dynamic networks or every few hours for extremely dynamic networks, especially if there are constant network device changes and additions. The last frequency option is to run only once. This option is excellent for those who only want to execute Network Sonar Discovery manually instead of being on a regular scan schedule. Finally, you must choose whether or not to execute the discovery now or later. Choosing to run now will save the profile and immediately execute the discovery scan. Choosing No, don't run now will only save and schedule the discovery profile. Choose the Frequency option Once and the execution setting No, don't run now to create the profile without scheduling it. The profile will then require an administrator to manually execute the scan. If you need to go back and make a change to your settings, or if you want to review your chosen settings, click on the BACK button. You can go back all the way to the first step of the Network Sonar Wizard if need be. Click on the SCHEDULE button in the final step to save the profile. Next steps Once a discovery profile has been created, access to the full Network Sonar Discovery page is enabled. You return here to view the results of the discovery scans and after Orion NPM has begun monitoring discovered nodes. To access the page, open Orion Web Administration and click on the Network Sonar Discovery link under Getting Started with Orion. Inside this page are the following three tabs: Network Sonar Discovery: This is where you will find all of your network scanning profiles Scheduled Discovery Results: This tab lists all of the resources that were discovered during its last scan Discovery Ignore List: This tab displays all of the previously discovered items that you have defined to be ignored in any future network scans [ 87 ]

23 Device Management In Network Sonar Discovery, all of the network discovery scan profiles are listed onscreen. You can run a discovery job, schedule a discovery, change the settings of an existing discovery profile, create a new discovery profile, and delete a profile. The display grid shows the discovery profile title and description, its frequency, status, and the last time that the discovery was executed (if at all): The buttons Import All Results and Import New Results are of special note here. Depending on what was discovered in the chosen scan, choosing Import All Results will simply add them to Orion NPM for monitoring, completely bypassing the requirement for an administrator to select what resources they want to add. The second button, Import New Results, performs the same task but only for new items discovered compared to the previous scan. Both of these options help to get a new Orion NPM system running quickly, but there are caveats with each option. An Orion administrator must always be aware of Orion NPM licensing when choosing what resources to monitor. This may not be a problem for those with an unlimited node count (SLX) license. You could easily use up all of your licensing if you import every single resource from a node! If you want to execute a discovery scan immediately, choose the Discover Now button. A notification window similar to the following screenshot will be displayed and Orion NPM will perform the scan now: [ 88 ]

24 Chapter 3 After an immediate discovery job finishes, the Network Sonar Results Wizard will display onscreen. Adding nodes Adding or importing nodes into Orion NPM is done in one of three ways: Network Sonar Results Wizard, Add Node Wizard, or Scheduled Discovery. You can access the same page at any time via Orion Web Administration by clicking on the Network Sonar Discovery link under the Getting Started with Orion module. Adding nodes from a Scheduled Discovery When a Scheduled Discovery has finished, the dashboard will display a notification in the top menu bar if Orion NPM found new nodes or node changes (such as a new interface or new hard disk). Clicking on the View Results link in the menu bar notification will open the Scheduled Discovery Results tab from the Network Sonar Discovery page. [ 89 ]

25 Device Management Nodes that have been discovered are shown in the Scheduled Discovery Results page. The results page is fairly straightforward and it is relatively easy to see what Orion NPM discovered during a scan. The node's Name, IP Address, Status, Description, Machine Type, Date Found, and the profile used to find the node (Discovered By) are all displayed in the grid. The Status column may be the most important piece of information in this tab since it shows if a node is newly discovered, if something has changed inside of a monitored node (such as an IP address change or interfaces have been added to it), or if the node was not added to Orion NPM after a previous discovery scan completed. A special note about changes: If a change is found on a currently monitored node, Orion NPM will continue to monitor that node as it was originally configured in the dashboard. An administrator must access the node's settings in Orion NPM in order to make a change to the monitoring configuration for that node. If this sounds confusing, here is an example: A switch was added to Orion NPM last month. Yesterday, a new trunk interface was added to the switch's configuration. Orion NPM will continue to monitor only what it was originally configured to monitor. If you want to monitor that new trunk interface, you need to edit the resources for the switch in the Orion dashboard. [ 90 ]

26 Chapter 3 Including nodes Imported nodes that have been discovered during a network scan will be displayed in the Scheduled Discovery Results tab. First, choose the nodes that you wish to import into Orion NPM, and then follow the import workflow to configure and monitor the nodes. Perform the following steps in order to add a single discovered node to Orion NPM: 1. Click on Import Nodes. 2. The Network Sonar Results Wizard will be displayed. In the DEVICES step, place a check mark next to the nodes you wish to add to Orion NPM and click on Next to proceed to the INTERFACES step. [ 91 ]

27 Device Management 3. Choose the interfaces you wish to monitor and click on Next to proceed to the VOLUMES step. Pay attention to the list of interfaces in this step. Only select what makes sense. For example, if you do not need to monitor loopback interfaces, then make sure you remove the check mark for those interface types. 4. Choose the volumes to monitor, if any, and then click on Next. Volumes primarily lie inside of servers or enterprise network appliances (such as load balancers, packet shapers, and NACs) and are usually not installed in routers or switches. However, times are changing and it is not uncommon to find some type of enterprise class router or switch chassis with its own disk volume(s). Remember that each volume will use one license in Orion NPM. Unless you absolutely must monitor a removable disk such as a DVD-ROM, never monitor a removable disk drive. [ 92 ]

28 Chapter 3 5. In the NPM IMPORT SETTINGS step, choose which interfaces you want to import and click on Next. The default options that are selected in this step are all interfaces that are operationally up, while anything shut down or operationally down are skipped. This is appropriate for most situations, but you may have a need to include certain interfaces that might not be operational at the moment. Above all, be mindful of your licensing in this step. 6. The IMPORT PREVIEW step is the overview screen for all of the decisions made in the previous steps. If you chose to import multiple nodes, then you will see all of the nodes listed here. Otherwise, if you only imported a single node, only one will be listed. The IGNORE button at the bottom of the page is useful if you need to skip importing any nodes listed in this step. Ignoring nodes will simply remove them from this list. Click on the IMPORT button to start the import process. [ 93 ]

29 Device Management 7. The RESULTS step displays the import process. It is important to pay attention to this screen because any problems during the import process will be displayed in a message on this screen. Clicking on FINISH will close the Network Sonar Results Wizard. Once the nodes have been imported, simply navigate to the Orion Summary Home screen where you can view its status. As you can see in the following screenshot, a router I imported now displays in the Summary Home page: [ 94 ]

30 Chapter 3 Discovery Ignore List Orion network discovery scans can, and occasionally will, discover devices and nodes that you do not actually want to monitor with Orion NPM. If this happens, you will want to tell Orion NPM to ignore these devices in future scans. For example; Orion NPM has discovered a wireless desktop printer on my network. I do not want to monitor this printer whatsoever, so it needs to be added to the Discovery Ignore List. The following is an example of how to load a node to the ignore list: 1. Place a check mark next to the node you wish to ignore. 2. Click on the Add to Ignore List button. 3. Click on the OK button on the notification window. 4. Click on the Discovery Ignore List tab and verify that the correct node has been added to the list. [ 95 ]

31 Device Management Manually adding nodes Performing network discovery scans are not the only way to import nodes into Orion NPM. Administrators can manually add nodes on-demand to Orion NPM. This is done using the Add Node wizard from the Orion Web Administration page. Add Node wizard Once the Add Node wizard appears, simply fill in the blanks and follow the workflow to add the resource to Orion NPM. The workflow is always displayed at the top of the page in the Add Node wizard. A sample of the breadcrumb menu is shown in the next screenshot. You can always click on the Back button within any of the steps to go back and make changes: There are five steps involved when adding a node manually in Orion NPM. They are as follows: 1. Define the node's IP address or DNS hostname that you wish to monitor. 2. Choose a polling method. 3. Choose the elements you want to monitor from the node, such as interfaces, volumes, VLANs, PortChannels, CPU, RAM, or virtual memory. 4. Add a custom or universal poller. 5. Change the node's properties before finalizing the settings and then add the node to Orion NPM. [ 96 ]

32 Chapter 3 In the DEFINE NODE step, there are the following three things that you must do in order to proceed: 1. Define the IP address or DNS hostname of the node. 2. Choose one of four polling methods. 3. Configure the additional polling options for Cisco UCS or VMware. When defining the Hostname, you can use the DNS hostname or the IP address of the node. Orion NPM assumes that the node has a fixed IP address assignment when an IP address is given. If you type an IP address, the Dynamic IP Address checkbox will grey out. If you have a node with a dynamic IP address (from BOOTP or DHCP), then you must type the DNS name of the node and check the Dynamic IP Address checkbox. [ 97 ]

33 Device Management As shown in the following screenshot, you must also choose an appropriate polling method: There are the following four different polling methods available and each is described, in detail, in the next section of this chapter: 1. No Status: Orion NPM will not collect any data on this node and it will not monitor it. It will only add the node to the summary list on the dashboard. 2. Status Only: This is for monitoring a node via ICMP (PING) only. Very little data can be gathered from this option. 3. Windows Servers: Orion NPM will poll the node using Windows Management Instrumentation (WMI) as well as ICMP. 4. Most Devices: This is the default option and is suitable for most devices. In it, you need to define the SNMP credentials, SNMP version, and port. The final options in this step are to define Additional Monitoring Options. If you are monitoring Cisco UCS or VMware nodes, make sure to place a check mark in the appropriate box, then click on Next to continue. [ 98 ]

34 Chapter 3 We are now moving on to the step to add Universal Device Pollers (UnDP) pollers. UnDP is a unique feature to Orion NPM where you can select very specific SNMP OID's from your device to collect specific data from a monitored node. Universal Device Pollers are covered in detail in Chapter 5, Network Monitoring II. Once you have made your selection, click on Next to continue. The final step is CHANGE PROPERTIES. It should look identical to the DEFINE NODE step aside from two additional properties at the bottom of the page: Polling and Custom Properties. [ 99 ]

35 Device Management The Polling area is where you define the polling engine settings for this specific node. The default setting is to check the heartbeat of the node every 120 seconds, collect various statistics from the node every 10 minutes, and poll for network topology data every 30 minutes. The Custom Properties area is where you can add some administrative notes about the node. After you have finalized the settings, click on OK, ADD NODE to import it into Orion NPM. Once the node has been added, you can find it on the Orion Summary Home page under the All Nodes module. Polling Most network devices and servers use counters and gauges to track performance and network activity against a variety of hardware and software resources inside of the node. The data from each of these counters and gauges can be extracted by Orion NPM using industry standard protocols such as WMI and SNMP and presented in an easy-to-understand format through the Orion dashboard. The process for extracting the counter and gauge data from a node is called polling. There are two reasons why you poll nodes, they are as follows: To verify the node's status To gather statistics Orion NPM polls for status to know if the node is available or if there is a problem. A common node status is if it is up or down. If the node is up, it is usually operating normally. If the node is down, then there is a good chance there is a problem with that device. [ 100 ]

36 Chapter 3 The second reason why we poll nodes is to gather statistics from the node's counters and gauges. We can gather CPU usage, free space available on storage volumes, how many errors have been countered on a network interface, and much more. Before a node is imported into Orion NPM, the software needs to know how it will be able to communicate with a node and what data it will be able to extract. Beyond the web-based dashboard, alerting engine, and other features of Orion, the polling engine is what truly drives a big portion of the Orion NPM system. The following is involved with the polling process: Defining polling methods an d polling settings Selecting resources/data to gather Collecting interface statistics Selecting an appropriate polling engine Polling methods The four polling methods in Orion NPM are as follows: No Status: External Node Status Only: ICMP Windows Servers: WMI and ICMP Most Devices: SNMP and ICMP The first is No Status: External Node, which means Orion NPM will not poll this node whatsoever and will not attempt to detect its up/down status. This option is for those that wish to add some type of node reference to the dashboard. Since Orion NPM isn't monitoring the status of this type of node, it is not using up a license. The Status Only: ICMP option tells Orion NPM to only use PING requests and replies to detect the node's up/down status. Checking the ICMP status is one of the simplest ways to monitor any type of node. The Windows Servers: WMI and ICMP option is strictly for polling CPU, memory, volume, and ICMP data from Windows-based computers. You cannot poll interfaces using the WMI and ICMP option. All Windows operating systems, including all desktop operating systems and server operating systems, have SNMP services embedded in its software, but they are disabled by default. [ 101 ]

37 Device Management If you want to poll for interface data on a Windows operating system with Orion NPM, you must enable and configure SNMP services on the Windows computer and choose the Most Devices: SNMP and ICMP polling option in Orion NPM. For instructions on how to set up SNMP services in a Windows Server, see the Microsoft TechNet article at com/kb/324263/en-us. You cannot use the WMI and ICMP option to poll Linux computers, Mac OS X computers, or network devices. This option is strictly for Windows computers. When choosing the WMI and ICMP option, you must enter the credentials that have access to perform WMI scans against the node. SolarWinds Orion will store those credentials in its database and bind them to the node specified. The username must always be in domain/username format. In the following example, I added the controller Windows server to Orion NPM using the IP address For the credentials, I used a domain service account with the username Sonar: [ 102 ]

38 Chapter 3 The final option, Most Devices: SNMP and ICMP, is the default selection, and it is what you will select 99 percent of the time you manually add a node to Orion NPM, especially if that node is a router or switch. The only exceptions to this rule are Windows computers. The default SNMP Version selected is SNMPv2c, the SNMP Port selected is 161, and the checkbox to Allow 64 bit counters is checked. You can change any of these settings as you see fit. However, it is highly recommended to use SNMPv2c or SNMPv3 and leave the checkbox enabled to allow 64-bit counters. SNMP counters wrap (meaning they go back to zero) when they hit their maximum limit. 64-bit counters allow for more counters in high capacity network interfaces such as 1 Gigabit and 10 Gigabit NICs. If you are using SNMP v2c or v3 to monitor your devices, it is highly recommended to leave the Allow 64 bit counters checkbox enabled. 64-bit counters are only supported in SNMP v2c and v3, while SNMP v1 supports only 32-bit counters. For more information on counters, Cisco has an excellent FAQ document on the subject at technologies_q_and_a_item09186a00800b69ac.shtml. [ 103 ]

39 Device Management If the node you wish to monitor is a Cisco Unified Computing System node, or if the node is a VMware ESX/ESXi host, you must check the corresponding box to successfully detect and poll these nodes for data. Failure to enter this information will cause the detection to fail for VMware hosts. When choosing the UCS manager credentials option, a new box appears at the bottom of the page where you must define the UCS credentials. When choosing the Poll for VMware option, define a user account that has access to the vcenter or ESX/ESXi host in order to continue to the next step. For security reasons, do not use the default root username. Create a new username with read-only access to the VMware host or vcenter server. [ 104 ]

40 Chapter 3 Selecting resources that Orion NPM can poll from a router or switch will be very different from the resources in a server. Due to fact that there are literally thousands of device types that can be monitored with Orion NPM, it is near impossible to show you every device type in an example. Instead, I am going to give three examples, all from extremely common devices that you will monitor with Orion NPM. These are routers, switches, and servers. When choosing which resources to monitor, it is a good idea to always monitor the CPU & Memory and Topology information since they don't require any additional licensing to do so in Orion NPM. The following screenshot is an example of resources from a Cisco router: Notice the serial interfaces on this router are not in use or are administratively down, so we are not going to monitor those interfaces. Also, items that may say Loopback or Null indicate that they are loopback ( ) interfaces. I never recommend monitoring a loopback interface unless absolutely necessary, as it will use up an additional interface license. I selected the FastEthernet0/0 interface since that is connected and in use. [ 105 ]

41 Device Management The second example is for switches. The following screenshot is from an HP Procurve switch: The resources in a switch are similar to a router, but as you can see, there are many more Ethernet ports available that can be monitored. Orion NPM will automatically place a check mark next to every single active interface, so be aware of what is chosen. A good rule of thumb with selecting switch ports to monitor is to select only what you need. Doing this will help you keep your license usage as low as possible. The ports that you would want to consider monitoring are trunk ports, VLANs, PortChannels, and EtherChannels. [ 106 ]

42 Chapter 3 Finally, the following screenshot is an example of resources from a Windows Server when monitoring it via WMI and ICMP: When compared to switches and routers, the resources in a server are almost completely different. The CPU & Memory resource still exists, but a new list of resources focusing on volumes is shown. In the example shown, three volume types have automatically been chosen; Physical Memory, Virtual Memory, and the Windows installation C:. If you remember the discussion about licensing in an Chapter 2, Orion NPM Configuration, this node will use three volume licenses. Network interfaces will not be available when you select the WMI and ICMP polling option at the time you add the server to the Orion NPM database. Orion NPM can only use SNMP to poll for interface data. [ 107 ]

43 Device Management Interface statistics When the SNMP and ICMP polling option is selected when adding a node to the Orion NPM database, there are several options available when monitoring interfaces. These options will not be available if the ICMP Only or WMI and ICMP polling options were chosen: As shown in the previous screenshot, I have the ability to monitor three interfaces in this router. However, I am only interested in monitoring the eth0 and eth1 interfaces. Expanding the interface display's settings gives us three options: Interface Availability Statistics Interface Traffic Statistics Interface Errors Statistics [ 108 ]

44 The Interface Availability Statistics option polls the interface for its up/down availability and stores the historical data in the Orion NPM database. It is a no-brainer to leave this option selected since it is most likely that you want to know if an interface's availability is up or down and be able to create historical reports on that availability. Chapter 3 The Interface Traffic Statistics option polls the interface for response time, interface utilizations, total bytes transferred in an out, average amount of packets in and out, and other useful data. It is an excellent idea to keep an eye on the inbound and outbound traffic statistics to make sure that the interface isn't oversubscribed or undersubscribed. Therefore, it is recommended to poll for traffic statistics whenever possible. The Interface Errors Statistics option polls the interface for packet loss, dropped packets (a.k.a. discards), and other interface error types. This statistic is especially useful when monitoring a WAN or wireless interface. By default, all statistic options are automatically selected when you choose to monitor an interface. Doing so doesn't use any additional interface licenses and it is a good idea to capture all statistical information whenever possible. But with that said, there may be instances where you do not have a need to monitor traffic, errors, and/ or availability statuses. You can opt-out of gathering data from a node where you see fit. The Orion NPM polling process will run just a tiny bit faster, but not enough so that it is a large performance gain. If you are not sure what to do, simply keep all of them enabled. Node & Group Management Finally, we arrive at Node & Group Management. It is the dashboard location where every device that has been added to Orion NPM can be internally managed. It is here where devices are removed from Orion NPM, configurations are edited, polling settings are defined, interface properties are edited, and where groups and dependency groups are managed. [ 109 ]

45 Device Management Nodes Nodes and interfaces can be managed directly from the Manage Nodes page in Orion Web Administration. In it, you can edit the monitoring settings and configurations for each node. There are a variety of properties and options that can be edited from this page. You can edit a node's properties such as its name in the dashboard and the polling method, change the resources being polled by Orion NPM, un-manage a node, re-manage a node, and assign third-party universal device pollers. Editing the Properties of a node will open a page very similar to the Add Node Wizard which will allow you to change any of Orion NPM's properties it has stored for that node. If you needed to change the polling method, the device's name, or even the IP address of the node you are monitoring, you will need to edit the node's properties. Changing the Resources will also take you through a page similar to the Add Node wizard, but will go straight to the List Resources step. Un-managing a node will disable Orion NPM from polling that device. When you re-manage the node, Orion NPM will resume polling as it has been configured to do so. Universal device pollers are covered extensively later in this book, but the Manage Nodes page in Orion Web Administration is where you assign additional pollers to a node. [ 110 ]

46 Chapter 3 Groups Orion NPM allows you to create custom groups. A group is a logical label of nodes or elements under one umbrella. Why would you want to use groups? Here are several examples: You are a Managed Service Provider (MSP) and manage and monitor all network devices and servers for your customers. For each customer, you create a group that includes all of their network equipment. Your business is headquartered in one area of the country, with several branch offices scattered throughout the world (each with network equipment monitored by Orion NPM). You can create a group in Orion NPM and add nodes for each location to their respective groups. A company has several buildings connected, each with several network closets, to your network over a large metropolitan area. You want to create a group for each building in Orion NPM. You have several WAN links to different Internet service providers on different routers in your network. You create a group to make it easier to display all of the interfaces on the Orion dashboard. You want to monitor several volumes in different servers on your network. You create a group that includes all of these volumes. Another reason for building groups in Orion NPM is that, thanks to Orion NPM's robust user permissions options, you can limit user account access to nodes in specific groups. This is great if you are an MSP since you would be able to grant access for a customer to log into your Orion NPM system to view monitoring on their own devices! Or, in a business with distributed IT personnel, you can limit access to a group for a specific team of individuals. The options are virtually endless. Creating and editing group memberships is done from the Manage Groups page under the Node & Group Management module in Orion Web Administration. There are several options you need to choose when creating a group in Orion NPM. First, you must define a unique group name and type a description. You must also choose the Status Rollup Mode and Status Refresh Frequency. [ 111 ]

47 Device Management The three options for Status Rollup Mode are Show Best Status, Mixed Status Shows Warning, and Show Worst Status. The default option is Mixed Status Shows Warning, and this is the recommended option. To create a group, perform the following steps: 1. Open Orion Web Administration. 2. Click on the Manage Groups link under Node & Group Management. 3. Click on Add New Group. 4. Type the group's Name and Description, and then click on Next to continue. [ 112 ]

48 Chapter 3 5. Every monitored node and interface that has been added to Orion NPM will be displayed in the Available Objects pane on the left-hand side. Choose all of the items that you want to add to the group, and then click on CREATE GROUP to continue. 6. The new group will be listed on the Manage Groups page. Click on the caret to expand the group to see which nodes were added. 7. Groups will also be listed on the Orion Summary Home page under the All Groups module. [ 113 ]

49 Device Management You can always edit a group's membership and settings from the Manage Groups page. One special thing to know about groups is that it is possible to nest groups inside of other groups. Dependencies A dependency is where you can define what node or interface is dependent on another. Dependencies operate in a parent-child relationship; when the top-level node goes down, Orion NPM automatically assumes that the child nodes are down as well and will mark them as Unreachable in the dashboard. Dependencies are used mostly for alerting reasons. Orion NPM will only notify an administrator about the parent node or interface not responding instead of multiple alerts for multiple nodes. This helps with allowing administrators to get down to the bottom of a problem more quickly and will not inundate them with multiple alerts. When you create a dependency, first you must choose what the parent will be. Then, you choose the child. The child can be a single monitored node or interface, or you can choose a node group or interface group. The parent cannot be a member of the same node group that you define as a child in the dependency. Creating dependencies is done from Orion Web Administration under the Node & Group Management module. [ 114 ]

50 Chapter 3 Perform the following steps to create a dependency in Orion NPM: 1. Click on the Add new dependency button. 2. Choose the parent node, then click on Next. 3. Choose the child node, then click on Next. 4. Review the settings in the dependency, make sure to define a meaningful Dependency name, and then click on Submit to finish. 5. Your new dependency will now appear in the list in the MANAGE DEPENDENCIES page. [ 115 ]

51 Device Management 6. Dependencies are also displayed on the Orion Summary Home page under the All Dependencies module. Interface configuration When you are monitoring a node using SNMP, and you are monitoring interfaces from that node, Orion NPM is able to detect the maximum bandwidth type of the interfaces that are a part of the node. For example, if you add a switch, and its uplink port is Gigabit Ethernet, then Orion NPM knows that the maximum throughput of that interface is 1000 Mbps. However, consider if you are using one of your Gigabit Ethernet ports as a WAN uplink to the Internet. What if the Internet service provider has a maximum download speed of 200 Mbps and an upload of 50 Mbps on this interface? Unless you configure the bandwidth options for that interface, Orion NPM will only report on the default settings. To change the configuration settings for a monitored interface, you must first open the Node Details View page of the monitored node from the Orion Summary Home page, or from Node Management in Orion Web Administration. The settings defined in the Edit Interface page only applies to the polling configuration for Orion NPM and does not affect the operation of the interface itself. From the Node Details View page, perform the following steps: 1. Scroll down to the Current Percent Utilization of Each Interface module and click on the interface you want to edit. In this example, I will be editing the Gi0/2 interface settings. [ 116 ]

52 Chapter 3 2. Now, click on Edit Interface under Interface Details. The Edit Interface page will appear. Available within it are five different settings: General Bandwidth Polling [ 117 ]

53 Device Management Custom Properties Dependencies General General options are where you can rename the interface and choose whether or not you want to display the interface as unplugged rather than down. The interface name is only an administrative note. If the interface already has a label assigned to it from the device (such as a port description in a Cisco switch), it will be displayed here by default. [ 118 ]

54 Chapter 3 The second option in the General section is to choose whether or not you want to display the interface as unplugged rather than down. By default, this option is left unchecked, which means that the Orion NPM alert engine will trigger an alert when the interface changes to a down state. Placing a check mark in this box will inform Orion NPM not to trigger an alert and instead mark the interface as unplugged. This option is useful when performing maintenance tasks on your network. Alerts are covered in more detail in Chapter 6, Setting Up and Creating Alerts. Bandwidth Bandwidth is the important part of this section. By default, both Transmit Bandwidth and Receive Bandwidth boxes are set to their maximum port speed and are grayed out. Check the Custom Bandwidth box to edit these areas. As stated before, you want to edit the bandwidth settings when monitoring WAN ports. Polling Polling options are inherited from the polling statistics for the node. However, Orion NPM allows you to edit the polling settings per interface. Custom Properties Custom Properties are tables added to the Orion NPM database for administrative and reporting purposes. You would use a custom property to make note of a carrier's circuit number for an interface, customer information, asset tag, location, or any other important information. CarrierName and Comments are the default custom properties available within the Edit Interface page. Custom Properties and the Custom Property Editor are covered in more detail in Chapter 5, Network Monitoring II. Dependencies We already discussed Dependencies in the previous section. However, Orion NPM provides a quick link to configure dependencies only for this interface. If there are already interface dependencies configured, they will be displayed here. [ 119 ]

55 Device Management Credential libraries When you import a node into Orion NPM and enter a set of credentials in order to poll that node, Orion NPM will store the credentials in its database. You can always go back and edit these credentials, add new ones, or delete them from the database. Orion NPM only stores the following three types of credentials: SNMP v3 credentials Microsoft Windows credentials VMware credentials SNMP credentials library If SNMP is chosen while adding a node to the Orion NPM database during the polling method, and you select SNMPv2 or SNMPv1, the community names are automatically saved to the Orion NPM database. SNMPv3 is a more secure version and requires a user account, password, and other attributes. To accommodate this, Orion NPM will store all SNMPv3 credentials in its database and they will only be displayed under the Polling Method section within Edit Nodes. This makes it easier to reuse, add, or remove these credentials in the future, especially when adding more nodes. To view the SNMP credential library, open the properties of a node that is currently being monitored via SNMP and scroll to the SNMP settings for that node. As shown in the following screenshot, when the SNMP version is set to SNMPv3, the Credential Set Library will be displayed: As you can see in the previous example, I have four different SNMPv3 credentials saved in my Orion NPM instance. Adding more SNMP credentials to the library is simple. Just fill out the form starting with the SNMPv3 Username and Context, Authentication type (MD5 or SHA1 hash) or Encryption information, Password, and then type a Name for the credential. Finally, create an administrative name for the SNMPv3 credential to store it in the database, and then click on the Save button. [ 120 ]

56 Chapter 3 Deleting saved SNMPv3 credentials is simple as well. Choose a saved credential set from the drop-down list from any monitored node, and then click on Delete. Unfortunately, Orion NPM does not display how many nodes may be using a specific SNMP credential, so you will need to make sure that the SNMPv3 credential truly is not in use by a node manually before deleting it. When you delete an SNMPv3 credential, Orion NPM will not warn you if the credential is currently in use by a node and it will simply delete it. Do not delete an SNMPv3 credential unless you are absolutely sure it is not in use. Windows credentials library Windows credentials are found in the Manage Windows Credentials link in Orion Web Administration. Every stored Windows credential will be displayed in the grid. All Windows credentials are shown in domain\username format as well as how many nodes have been assigned to a credential. From this page, you can create a new credential, edit a current credential, and delete any unused credentials. [ 121 ]

57 Device Management If the Windows password has changed, you will need to update the credential in the Manage Windows Credentials page. Simply place a check mark next to the credential and click on Edit Credential. On the edit screen, update the information and click on Ok. VMware credentials library The last credential type is VMware user accounts, which you can find in the VMware settings link in Orion Web Administration. Click on the VMware Credentials Library tab to view the stored credentials. VMware credentials operate in exactly the same fashion as Windows credentials. You can edit, delete, and add new credentials to the Orion NPM database. Unfortunately, Orion NPM also does not display how many nodes have a credential assigned to it. [ 122 ]

58 Chapter 3 Summary So, that is it for this chapter! We covered quite a few topics. We learned how to use the network discovery automated tools to add nodes to Orion NPM, and how to manually add nodes. We learned all about polling, as well as how to manage the nodes themselves, their interfaces, and credential sets. I'm going to keep the ball rolling and dive right into all of the details of monitoring in the next chapter. There is quite a bit of ground to cover, but I know that you will find it fairly easy to understand once we get started! [ 123 ]

59 Where to buy this book You can buy SolarWinds Orion Network Performance Monitor from the Packt Publishing website: Free shipping to the US, UK, Europe and selected Asian countries. For more information, please read our shipping policy. Alternatively, you can buy the book from Amazon, BN.com, Computer Manuals and most internet book retailers.